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EXECUTIVE DEPARTMENTS AND ESTABLISHMENTS 


SUBJECT: Audit Requirements for Federal Financial Statements 


1. Purpose: This Bulletin, which includes an attachment and Appendices A-E, implements the 
audit provisions of the Chief Financial Officers Act of 1990 (CFO Act) (Pub. L. No. 101-576), as 
amended, the Government Management Reform Act of 1994 (GMRA) (Pub. L. No. 103-356), and 
the Federal Financial Management Improvement Act of 1996 (FFMIA) (Pub. L. No. 104-208, title 
VII). The requirements of this Bulletin are set forth in the attachment. 


2. Authority: The Bulletin is issued under the authority of title 31 of the United States Code, 
chapters 5 and 35. 


3. Applicability: The provisions of this Bulletin apply to audits of financial statements of 
Executive Branch departments and agencies (Appendices A and C) and certain components 
thereof (Appendix B), and Government corporations (Appendix D). 


A. Rescissions: The provisions of this Bulletin supersede the provisions in OMB Bulletin 21-04, 
Audit Requirements for Federal Financial Statements. 


5. Effective Date: The provisions of this Bulletin are effective immediately for audits of financial 
statements, unless stipulated otherwise. The auditor’s report(s) must be submitted to the reporting 
entity head in sufficient time to enable the agency head to meet the deadline for submitting the 
audited financial statements. 


6. Inquiries: Further information concerning this Bulletin may be obtained from the Office of 
Management and Budget, Office of Federal Financial Management at 202-395-3993. 


7. Copies: Individual copies of this bulletin may be obtained from the OMB website at Bulletins 
The White House. 
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SUMMARY OF KEY CHANGES 


Section Title Paragraph Changes 
Number(s) 
Multiple Multiple “Will” changed to “must” where 


appropriate. Updated AU-C reference to 
delete suffix “B,” e.g., AU-C 600B, 
because of implementation of SAS 134- 
140. Updated title of AU-C 720. 


Section 2, Definitions 2.3 Clarified definition of deficiency in 


internal control to include definitions of 
deficiency in design and deficiency in 


operations. 
Section 2, Definitions 2.6 Streamlined. 
Section 2, Definitions 2.11 Added footnote reference to Internal 


Controls Standards and changed 
explanation of internal control process to 
align with the Internal Control Standards. 
Section 2, Definitions 2.12 Modified definition of intragovernmental 
to more closely align with the definition in 
A-136 and to clarify that transactions with 
the Federal Reserve and GSEs are not 
considered intragovernmental. 


Section 5, Communication 5.5 Clarified and streamlined text to focus on 
communication requirements, which 
resulted in moving text into paragraph 7.7. 


Section 5, Communication 5.6-5.8 Deleted text as unnecessary and 
duplicative of A-136. 

Section 6, Scope of the 6.5 Added footnote to A-136 section on 

Audit parent-child reporting. 

Section 6, Scope of the 6.7 Modified text to align with AU-C 720.16. 

Audit 

Section 6, Scope of the 6.11 Modified text to align with AU-C 250.10. 

Audit 

Section 6, Scope of Audit Former 6.17 Moved to become paragraph 6.12. 

Section 7, Reporting fad Modified reference to AU-C 730. 

Section 7, Reporting Le Added sentences from paragraph 5.5. 

Section 7, Reporting 7.14 and 7.17 7.17 moved to 7.14. New 7.17 modified to 


reflect GAGAS section 6.41 requirement 
and to be consistent with AU-C 250.24. 
Section 7, Reporting 725 Streamlined text. 

Section 7, Reporting 7.26 Deleted as unnecessary. 


Section 11, Agreed-Upon 11.8 Deleted reference to OPM IG. 
Procedures: Retirement, 
Health Benefits, and Life 
Insurance 
Withholdings/Contributions 
and Supplemental Semi- 
Annual Headcount Report 
Submitted to OPM 


Appendix B N/A Added footnote related to U.S. Marine 
Corps. 

Appendix C N/A Deleted the Vietnam Education 
Foundation, which by law, sunset in 2018. 

Appendix E Representation 44 Clarified Representation 44 pertaining to 


potential ADA violations. 


AUDIT REQUIREMENTS FOR FEDERAL FINANCIAL STATEMENTS 


SECTION 1: BACKGROUND 


1.1. The Government Management Reform Act of 1994 (GMRA) (Pub. L. No. 103-356) 
expanded the Chief Financial Officers Act of 1990 (CFO Act) (Pub. L. No. 101-576) by requiring, 
among other things, the annual preparation and audit of organization-wide financial statements of the 
Executive Branch departments and certain Executive Branch independent agencies (CFO Act 
agencies, Appendix A). The GMRA also requires audited financial statements of components of 
Executive Branch departments and agencies designated by the Director of the Office of Management 
and Budget (OMB) (Appendix B). 


1.2. The Accountability of Tax Dollars Act of 2002 (ATDA) (Pub. L. No. 107-289) expanded the 
CFO Act further and extends the requirements of the annual preparation and audit of 
organization-wide financial statements to the remainder of the Executive Branch independent 
agencies not already required to do so through another provision of Federal law (Appendix C). 


L3 Chapter 91 of title 31, United States Code, requires, among other things, the annual 
preparation and audit of organization-wide financial statements of "mixed-ownership" and "wholly 
owned" Government corporations (Appendix D). 


SECTION 2: DEFINITIONS 
For the purposes of this Bulletin, the following definitions apply: 


ZA Annual Financial Statements (financial statements) mean the financial statements of a 
reporting entity as described in 31 U.S.C. 83515 and OMB Circular A-136, Financial Reporting 
Requirements, as revised (A-136) and consist of: 
e Management's Discussion and Analysis (MD&A), which is part of Required Supplementary 
Information (RSI) 


e Basic Information, including: 


Balance Sheet 
Statement of Net Cost 


Statement of Changes in Net Position 
Statement of Budgetary Resources 
Statement of Custodial Activity, if applicable 
Statement of Social Insurance, if applicable 
Statement of Changes in Social Insurance Amounts, if applicable 
Notes to the Financial Statements 
e RSI, if applicable 
e Other Information, if applicable 


2.2 Codification of Statements on Auditing Standards is a codification of Statements on 
Auditing Standards (SASs) issued by the American Institute of Certified Public Accountants 
(AICPA). Generally Accepted Government Auditing Standards (GAGAS) incorporate by reference 


SASs issued by the AICPA. As a result, auditors performing audits of financial statements in 
accordance with GAGAS should comply with the incorporated SASs and the additional 
requirements of GAGAS. 


2.3. Deficiency in Internal Control exists when the design or operation of a control does not 
allow management or employees, in the normal course of performing their assigned functions, to 
prevent, or detect and correct, misstatements on a timely basis. A deficiency in design exists when 
(a) a control necessary to meet the control objective is missing or (b) an existing control is not 
properly designed so that even if the control operates as designed the control objective would not be 
met. A deficiency in operation exists when a properly designed control does not operate as designed 
or when the person performing the control does not possess the necessary authority or competence to 
perform the control effectively. 


2.4 Federal Financial Management Improvement Act of 1996 (FFMIA) (Pub. L. No. 104- 
208, Title VIII) Section 803(a) requires CFO Act agencies to establish and maintain financial 
management systems that comply substantially with Federal financial management systems 
requirements, applicable Federal accounting standards, and the United States Government Standard 
General Ledger at the transaction level. 


2.5. Federal Managers’ Financial Integrity Act (FMFIA) (Pub. L. No. 97-255, codified at 31 
U.S.C. §3512(c), (d)) requires Executive Branch agencies to establish and maintain effective internal 
control. The heads of agencies must annually evaluate and report on the effectiveness of the internal 
control (Section 2) and financial management systems (Section 4) that protect the integrity of 
Federal programs. 


2.6 U.S. Generally Accepted Accounting Principles (U.S. GAAP) for Federal Government 
entities are promulgated by the Federal Accounting Standards Advisory Board (FASAB). Statement 
of Federal Financial Accounting Standards (SFFAS) 34, The Hierarchy of Generally Accepted 
Accounting Principles, Including the Application of Standards Issued by the Financial Accounting 
Standards Board prescribes the U.S. GAAP hierarchy, which consists of the sources of accounting 
principles and the framework for selecting the principles used in the preparation of financial 
statements of Federal reporting entities. 


2.7. Government Accountability Office/Council of the Inspectors General on Integrity and 
Efficiency Financial Audit Manual (GAO/CIGIE FAM) provides methodology and guidance for 
conducting audits of Federal financial statements in accordance with relevant auditing standards and 
OMB guidance. References to the GAO/CIGIE FAM do not establish requirements for auditors. 


2.8 Government Auditing Standards (also referred to as U.S. Generally Accepted 
Government Auditing Standards or GAGAS) are those auditing standards issued by the 
Comptroller General of the United States. ! 


2.9 Group Financial Statements include financial information of more than one component, or 
combined financial statements aggregating the financial information prepared by components that 


1 GAO, Government Auditing Standards 2018 Revision, GAO-18-568G (Washington, D.C., July 17, 2018). 


are under common control. Auditors should refer to AU-C 600, Audits of Group Financial 
Statements (Including the Work of Component Auditors), for additional guidance/requirements when 
performing an audit of group financial statements. See also GAO/CIGIE FAM Section 630, Audits of 
Group Financial Statements. 


2.10 Independent Auditor means an audit organization or individual auditor who meets the 
independence requirements under GAGAS. An independent auditor may include the GAO, an 
agency's Office of Inspector General (OIG), and/or an independent public accountant (IPA). 


2.11 Internal Control is a process effected by an entity’s oversight body,* management, and other 
personnel that provides reasonable assurance that the objectives of the entity will be achieved. These 
objectives and related risks can be broadly classified into one or more of the following three 
categories: 1) operations — effectiveness and efficiency of operations, 2) reporting — reliability of 
reporting for internal and external use, and 3) compliance — compliance with applicable laws and 
regulations.° Internal control over safeguarding of assets against unauthorized acquisition, use, or 
disposition may include controls relating to financial reporting and operations objectives. Although 
most controls relevant to the audit are likely to relate to financial reporting, not all controls that 
relate to financial reporting are relevant to the audit. Consistent with the guidance set forth in OMB 
Circular A-123, Management's Responsibility for Enterprise Risk Management and Internal Control, 
internal control over financial reporting is more narrowly defined and includes: 


¢ Reliability of financial reporting - transactions are properly recorded, processed, and 
summarized to permit the preparation of the financial statements in accordance with U.S. 
GAAP, and assets are safeguarded against loss from unauthorized acquisition, use, or 
disposition. 


¢ Compliance with laws, regulations, contracts, and grant agreements - transactions are 
executed in accordance with provisions of applicable laws, including those governing the 
use of budget authority, regulations, contracts, and grant agreements, noncompliance with 
which could have a material effect on the financial statements. 


2.12  Intragovernmental means activity and balances that arise from transactions within a 
reporting entity (i.e., intra-entity) and between the reporting entity and other consolidation entities 
(i.e., inter-entity). Intragovernmental activity and balances are eliminated in the U.S. Government’s 
consolidated financial statements. Intragovernmental transactions do not include transactions with 
the Federal Reserve, Government-sponsored enterprises, or other entities not considered to be 
consolidation entities. 


2.13. Management Letter is one means of communication prepared by the auditor that discusses 
findings and recommendations for improvements in internal control, which were identified during 
the audit (see Paragraph 5.4). 


* Government Auditing Standards, cited in the previous footnote, paragraph 1.04 uses the term “those charged with 
governance” to refer to those responsible for internal controls over financial reporting. Standards for Internal Control in the 
Federal Government, GAO-14-704G (Washington, D.C., September 2014) paragraph OV1.01 uses the broader term “an 
entity’s oversight body” to refer to those responsible for the overall internal control system. 

3 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C., September 2014). 


2.14 MD8&A is a clear and concise description of the reporting entity's performance measures, 
financial statements, information systems and controls, compliance with laws and regulations, and 
actions taken or planned to address problems.* The MD&A is included in the Agency Financial 
Report (AFR) or Performance and Accountability Report (PAR) as RSI. A-136 provides additional 
guidance on the composition of the MD&A. 


2.15 Material Weakness is a deficiency, or a combination of deficiencies, in internal control over 
financial reporting, such that there is a reasonable possibility” that a material misstatement of the 
entity's financial statements will not be prevented, or detected and corrected, on a timely basis. This 
material weakness definition aligns with the material weakness definition used by management to 
prepare a reporting entity's FMFIA Statement of Assurance on the effectiveness of internal control 
over financial reporting. 


2.16 Reporting Entity means one of the executive departments, agencies, Government 
corporations and components of such departments and agencies listed in Appendices A-D, or an 
agency, bureau, or other organization that represents a meaningful unit for program management, for 
which financial statements are prepared because either there is a statutory or administrative 
requirement or management chose to prepare financial statements. 


2.17 Significant Deficiency is a deficiency, or a combination of deficiencies, in internal control 
that is less severe than a material weakness yet important enough to merit attention by those charged 
with governance.° 


2.18 Significant Entities refer to Federal entities deemed significant in the U.S. Government’s 
most recent consolidated financial statements (CFS). The 24 Chief Financial Officers Act entities 
and additional entities are identified by the Department of the Treasury (Treasury) as significant 
entities in the Treasury Financial Manual (TFM), TFM 2-4700 Appendix 1a. 


2.19 U.S. Standard General Ledger (USSGL) means the uniform chart of accounts prescribed in 
the TFM. 


SECTION 3: FREQUENCY OF AUDIT 


3.1 Audits must be performed annually. To support the CFS audit, significant entities, as identified 
in TFM 2-4700, with a calendar year-end are required to obtain audit assurance on certain line items 
as of September 30. These entities are the Farm Credit System Insurance Corporation, Federal 
Deposit Insurance Corporation, and National Credit Union Administration. These entities may refer 
to TFM 2-4700 section 4705.40 for additional guidance. 


4 Statement of Federal Financial Accounting Standards (SFFAS) 15, Management's Discussion and Analysis and SFFAS 37, 
Social Insurance: Additional Requirements for Management’s Discussion and Analysis and Basic Financial Statements. 

° In this definition, a reasonable possibility exists when the likelihood of the event is reasonably possible or probable as those 
terms are used in AU-C 265, Communicating Internal Control Related Matters Identified in an Audit. 

® Consistent with AU-C 260, The Auditor's Communication With Those Charged With Governance, GAGAS defines those 
charged with governance as the person(s) or organization(s) with responsibility for overseeing the strategic direction of the 
entity and the obligations related to the accountability of the entity. This includes overseeing the financial reporting 

process, subject matter, or program under audit including related internal controls. 


SECTION 4: RESPONSIBILITY FOR AUDIT 
For purposes of this Bulletin, the following responsibilities apply: 


4.1 For the CFO Act agencies and selected components of such agencies (listed in Appendices A 
and B), the audits of financial statements must be performed by the OIG of the executive department 
or agency or by an IPA as determined by the OIG. 


4.2 For Government corporations and the executive agencies subject to the ATDA, the audits of 
financial statements must also be performed by the OIG of the executive entity or by an IPA as 
determined by the OIG. If the entity does not have an OIG, the financial statement audit must be 
performed by an IPA as determined by management. 


4.3. The CFO Act, as amended, provides that, in lieu of an audit otherwise required, the 
Comptroller General of the United States may, following consultation with the OIG, perform the 
audit of the CFO Act executive departments and agencies, as well as Government corporations and 
ATDA entities. 


SECTION 5: COMMUNICATION 


5.1 The auditor should agree upon the terms of the audit engagement with management or those 
charged with governance, as appropriate. The agreed-upon terms of the audit engagement should be 
documented in an audit engagement letter or other suitable form of written agreement. 
Management’s agreement should be in writing and may be incorporated as part of the audit 
engagement letter, as shown in the examples in GAO/CIGIE FAM Section 215 A (AU-C 210.10 and 
A42). In accordance with AU-C 701, Communicating Key Audit Matters in the Independent 
Auditor’s Report, auditors are not required to communicate key audit matters in the auditor’s report 
unless the auditor has been engaged to do so. For Federal reporting entities covered by reporting 
requirements in A-136, such engagement (as described in AU-C 701) is not required.’ 


5.2 Communications with the reporting entity, those charged with governance, and, if applicable, 
the individuals contracting for or requesting the audit are expected to be honest, candid, and 
constructive.® Auditors should refer to AU-C 260, The Auditor's Communication With Those 
Charged With Governance. Auditors should also refer to GAGAS 6.06 for additional requirements 
pertaining to auditor communication. Matters that may be communicated include, but are not limited 
to, the following: 


¢ The financial statements preparation and audit timetable and changes thereto, including 
all changes that could cause the reporting entity to be unable to issue its AFR/PAR by the 
deadline set in A-136; 


¢ Significant issues regarding the preparation and audit of the financial statements 
(including potential delays in the timely issuance of the auditor’s report); and 


? AU-C 701 is applicable to audits of financial statements for periods ending on or after December 15, 2021. 
8 GAGAS 3.09. 
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¢ Potential audit findings as they are developed, including indications of material 
misstatements or unsupported amounts in the financial statements; significant deficiencies 
and material weaknesses in internal control; non-compliance with provisions of laws, 
regulations, contracts, and grant agreements; and any findings that could delay issuance 
of the auditor’s report. For some matters, early communication to those charged with 
governance or management may be important because of the relative significance and the 
urgency for corrective follow-up action.° 


5.3 Auditors should bring misstatements to management's attention for analysis and possible 
adjustment. Written representations from management should address uncorrected misstatements. 
(See Paragraph 8.1 for a discussion of a summary of uncorrected misstatements to be attached to 
management's written representations and see Paragraph 8.4 for management's materiality threshold 
used for reporting items in written representations from management). Auditors should refer to AU- 
C 450, Evaluations of Misstatements Identified During the Audit, and are encouraged to use the 
guidance in GAO/CIGIE FAM Section 540, Evaluate Effects of Misstatements on Financial 
Statements and Auditor’s Reports, for reviewing misstatements with management. 


5.4 Auditors may recommend actions to correct deficiencies identified during the audit and to 
improve controls over financial reporting. When provided, such recommendations should be 
included in the auditor's report on internal control over financial reporting; in a separate report, 
memorandum, management letter, or other written communication; or communicated orally. '° 
Recommendations should be directed at resolving the root cause of identified deficiencies and 
findings, and clearly state the actions recommended. Recommendations should also be directed to 
the extent possible to addressing the particular deficiency on a reporting entity basis, rather than 
directed to the particular instance of weakness. 


Misstatements in Previously Issued Financial Statements 


5.9  Ifasubsequently discovered fact existing at the date of the auditor’s report becomes known to 
the auditor after the report release date, the auditor should discuss the matter with management and, 
when appropriate, those charged with governance and refer to AU-C 560, Subsequent Events and 
Subsequently Discovered Facts. In addition, if the auditor becomes aware of any material 
misstatement(s), whether factual, judgmental, or projected, affecting a previously issued financial 
statement(s), then the auditor will advise the reporting entity’s management to determine the specific 
amount(s) of the material misstatement(s) and the related effect(s) of such on the previously issued 
financial statement(s) as soon as reasonably possible. The auditor should advise the reporting 
entity’s management to follow guidance in A-136. 


5.6 The auditor will notify those charged with governance, oversight bodies, and funding 
agencies when management (1) does not take the necessary steps to promptly inform report users of 
the situation, or (2) does not restate with appropriate timeliness the financial statements in 
circumstances when the auditor believes they need to be restated. The auditor will inform these 
parties that the auditor will take steps to prevent future reliance on the auditor's report. The steps 


° AICPA AU-C 265, Communicating Internal Control Related Matters Identified in an Audit. 
10 GAGAS 6.50-6.52. 


11 


taken will depend on the facts and circumstances, including legal considerations. This includes 
communication in writing to the Congress, OMB, Fiscal Service, and GAO as well as any other 
users known to rely on the previously issued financial statement(s). 


SECTION 6: SCOPE OF THE AUDIT 


6.1 Financial statements must be audited in accordance with GAGAS and the provisions of this 
Bulletin. 


6.2 The auditor will determine whether the financial statements present fairly, in all material 
respects, the net position; net costs; changes in net position; budgetary resources; and, if applicable, 
custodial activity, social insurance information,'! and changes in social insurance amounts in 
accordance with U.S. GAAP. 


6.3 If consolidating statements are presented and the auditor is engaged to opine on whether such 
consolidating statements are fairly stated, in all material respects, in relation to the financial 
statements taken as a whole, the consolidating statements are considered supplementary information 
and the auditor should apply the requirements of AU-C 725, Supplementary Information in Relation 
to the Financial Statements as a Whole. Otherwise, such consolidating statements are considered 
other information and the auditor should apply the requirements of AU-C 720, The Auditor’s 
Responsibilities Relating to Other Information included in Annual Reports. 


6.4 — If the auditor is unable to determine whether the financial statements are fairly presented 
because of, for example, the auditor's inability to obtain sufficient appropriate audit evidence due to 
inadequate accounting records, the auditor will, to the extent practical, obtain sufficient evidence 
about closing balances to support the audit of the subsequent year's financial statements. 


6.5 When auditing allocation transfers '* from a Federal entity (referred to as the parent) to 
another Federal entity (referred to as the child), the parent's auditor (whether the OIG or IPA) is 
responsible for ensuring that the child's information receives the audit coverage that, in the auditor's 
professional judgment, is required as part of the parent's financial statement audit (i.e., the amount 
should be subject to the same financial statement auditing procedures and materiality considerations 
as all other funding sources). As such, the two Federal entities may need to coordinate to ensure that 
the parent auditor's needs, as they relate to the allocation transfer, are met. Such coordination may 
take place during the early planning phase of the financial statement audit. In addition to parent-child 
transfers, there may be other situations where such coordination is necessary. 


6.6 The auditor will perform the procedures described in AU-C 730, Required Supplementary 
Information, for RSI (i.e., Management's Discussion and Analysis, Combining Statement of 
Budgetary Resources, Deferred Maintenance and Repairs, Federal Land, etc.) as defined by FASAB. 


1 See AU-C 9700, Forming an Opinion and Reporting on Financial Statements: Auditing Interpretations of AU-C Section 
700, section 2, Sustainability Financial Statements Under Federal Financial Accounting Standards — Auditor Reporting, 
paragraphs .06 and .07. Paragraph .07 provides an illustrative auditor’s report. 

?2 See A-136 section II.3.1.1, Parent-Child Reporting, for more information. 
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6.7. In accordance with the requirements of AU-C 720, The Auditor’s Responsibilities Relating to 
Other Information included in Annual Reports, the auditor should read the other information in the 
reporting entity's AFR or PAR and consider whether a material inconsistency exists between the 
other information and the financial statements. 


6.8 In accordance with AU-C 315, Understanding the Entity and Its Environment and Assessing 
the Risks of Material Misstatement, the auditor should obtain an understanding of internal control 
relevant to the audit. Although most controls relevant to the audit are likely related to financial 
reporting, not all controls that relate to financial reporting are relevant to the audit. It is a matter of 
the auditor's professional judgment whether a control, individually or in combination with others, is 
relevant to the audit. When obtaining an understanding of controls that are relevant to the audit, the 
auditor should evaluate the design of those controls and determine whether they have been 
implemented. Risk assessment procedures to obtain audit evidence about the design and 
implementation of relevant controls may include inquiring of entity personnel; observing the 
application of specific controls; inspecting documentation and reports; and tracing transactions 
through the information system relevant to financial reporting. However, inquiry alone is not 
sufficient for such purposes. 


The auditor should obtain an understanding of the control activities relevant to the audit, which are 
those control activities that the auditor judges as necessary to assess the risk of material misstatement 
at the assertion level and design further audit procedures responsive to assessed risks. An audit does 
not require an understanding of all control activities related to each significant class of transactions, 
account balance, and disclosure in the financial statements or to every assertion relevant to them. 
However, the auditor should obtain an understanding of the process of reconciling detailed records to 
the general ledger for material account balances. 


The auditor should obtain an understanding of the information system, including the related business 
processes relevant to financial reporting, including the following areas: 


¢ The classes of transactions in the entity's operations that are significant to the 
financial statements; 


¢ The procedures within both information technology and manual systems by which those 
transactions are initiated, authorized, recorded, processed, corrected as necessary, 
transferred to the general ledger, and reported in the financial statements; 


¢ The related accounting records supporting information and specific accounts in the 
financial statements that are used to initiate, authorize, record, process, and report 
transactions. This includes the correction of incorrect information and how information 
is transferred to the general ledger. The records may be in either manual or electronic 
form; 


¢ How the information system captures events and conditions, other than transactions, that 
are significant to the financial statements; 


¢ The financial reporting process used to prepare the entity's financial statements, 
including significant accounting estimates and disclosures; and 


¢ Controls surrounding journal entries, including nonstandard journal entries used to 
record nonrecurring, unusual transactions, or adjustments. 
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In addition to the requirements set forth in AU-C 330, Performing Audit Procedures in Response to 
Assessed Risks and Evaluating the Audit Evidence Obtained (paragraph .08) and GAGAS, for those 
controls that have been suitably designed and implemented, the auditor will perform sufficient tests 
of such controls to conclude whether the controls are operating effectively (i.e., sufficient tests of 
controls to support a low level of assessed control risk). Thus, the auditor should not elect to forgo 
control tests because it is more efficient to extend substantive and compliance audit procedures. 
Controls that are not suitably designed and implemented or that are not operating effectively will be 
communicated in accordance with Section 7 of this Bulletin. 


6.9 In obtaining an understanding of the components of internal control, particularly the risk 
assessment component, and assessing control risk, the auditor will obtain an understanding of the 
process by which the executive agency identifies and evaluates weaknesses required to be reported 
under FMFIA and the related reporting entity’s implementing procedures. 


6.10 The auditor will compare material weaknesses disclosed during the audit with those material 
weaknesses reported in the reporting entity’s FMFIA report that relate to the financial statements of 
the reporting entity under audit. The auditor should consider whether the failure to detect and report 
material weaknesses constitutes a significant deficiency or material weakness in the reporting entity's 
internal control. 


6.11 The auditor should obtain sufficient appropriate audit evidence regarding material amounts 
and disclosures in the financial statements that are generally recognized to be determined directly by 
the provisions of laws, including those governing the use of budget authority; regulations; contracts; 
and grant agreements, consistent with AU-C 250.13, Consideration of Laws and Regulations in an 
Audit of Financial Statements. (See also GAGAS 6.15 for additional requirements pertaining to the 
consideration of compliance with provisions of contracts and grant agreements). The auditor should 
also perform audit procedures, as described in AU-C 250.14, that may identify instances of 
noncompliance with other laws, regulations, contracts, and grant agreements that may have a 
material effect on the financial statements. The auditor should respond appropriately to 
noncompliance or suspected noncompliance with laws, regulations, contracts, and grant agreements; 
see AUC 250.17-27 and GAGAS 6.13-6.14, 6.41, 6.44, and 6.48-6.49. 


6.12 The auditor will perform tests to determine whether the reporting entity's financial 
management systems comply substantially with FFMIA Section 803(a) requirements. This provision 
only applies to audits of CFO Act agencies and components thereof, including components that are 
Government corporations. The CFO Act agency components, including the Government 
corporations, are not required to report separately on compliance with FFMIA; further, auditors of 
separately issued component reports are not required to separately report on whether the component's 
financial management systems comply substantially with FFMIA, Section 803(a) requirements. 
Government corporations and agencies subject to the ATDA are not subject to the requirements of 
FFMIA, with the exception of Government corporations that are also components of one of the CFO 
Act agencies. 


Support for the U.S. Government Consolidated Financial Statements 
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6.13 Intragovernmental activity and balances are a key component in the consolidation of the 
financial information submitted by Federal entities and in the overall compilation process of the 
CFS. Intragovernmental transactions include the sale of services or goods to another Federal entity, 
transfers of assets or budget authority between Federal entities, investments or borrowings with 
Treasury, and benefit-related transactions with the Department of Labor and the Office of Personnel 
Management. See the TFM 2-4700 for information related to: (1) management’s responsibility for 
routinely recording, reconciling, resolving, and reporting intragovernmental transactions, (2) the 
quarterly and year-end requirements to reconcile and resolve the reported intragovernmental activity 
and balances, and (3) intragovernmental transactions metrics and scorecards. See also the 
GAO/CIGIE FAM, Volume 2, Section 902 for information related to auditing intragovernmental 
activity and balances. 


6.14 The auditor should obtain an understanding of the control activities related to 
intragovernmental activity and balances, including identifying and recording intragovernmental 
transactions, reconciling intragovernmental transactions with Federal trading partners, resolving’ 
intragovernmental differences with Federal trading partners, and reporting intragovernmental 
activity. See, in particular, the GAO/CIGIE FAM, Volume 2, Sections 902.18-902.21. 


6.15 The auditor will inquire of the reporting entity to gain an understanding of and obtain copies 
of any adjusting journal entries Treasury recorded during its prior year consolidation process that 
impacted the reporting entity, including the underlying reason or issue that warranted the entry. This 
inquiry should cover all journal entries, including those affecting intragovernmental and other than 
intragovernmental (i.e., amounts that are not intragovernmental, also referred to as “with the public”) 
line items. The auditor will consider the impact of the journal entries on current audit procedures. 


6.16 Amounts and disclosures in the CFS are directly supported by information in significant 
entities’ audited financial reports (e.g., AFRs or PARs). For example, the audit procedures 
performed over the note pertaining to the reclassification of the significant entity’s audited entity- 
level financial statements to the government-wide line items as well as other disclosures required by 
A-136 are critical to the CFS preparation and audit process. 


6.17 Significant entities’ auditors should perform the procedures requested by GAO in the annual 
Communication Letter Related to the Audit of the Consolidated Financial Statements of the U.S. 
Government, such as for (1) the intragovernmental balances by trading partner reported by 
management to the Government-wide Treasury Account Symbol Adjusted Trial Balance (GTAS) 
system and (2) treaties and other international agreements. 


Audits of Group Financial Statements 


6.18 A group audit is the audit of group financial statements. It applies when the financial 
statements include financial information of more than one component as well as combined financial 
statements that aggregate the financial information prepared by components that are under common 
control. Auditors should refer to AU-C 600, Audits of Group Financial Statements (Including the 
Work of Component Auditors) when conducting an audit of group financial statements. See also 


13 See the GAO/CIGIE FAM Section 902.02. 
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GAO/CIGIE FAM Section 630, Audits of Group Financial Statements. The following summarizes 
some of the requirements of a group audit. 


6.19 The group engagement team should obtain sufficient appropriate audit evidence over the 
group financial statements through the group engagement team's work or the work of component 
auditors. Therefore, the group engagement team is required to be involved with component auditors 
and make decisions about the components including identifying significant components, determining 
whether to refer or take responsibility for the component work, and assessing risk. 


6.20 The group engagement team is required to communicate specific items to the component 
auditor, and group management and/or those charged with governance of the group. Additionally, 
the group engagement team is required to request that the component auditor also communicate with 
the group engagement team about certain matters. 


6.21 There must be coordination and communication between the component auditors and group 
auditors to effectively and efficiently comply with the requirements of AU-C 600. For example, this 
coordination and communication is required between GAO in its role as group auditor of the 
consolidated financial statements of the U.S. Government and the OIG/IPA in its role as component 
auditor. 


Using a Service Organization" 


6.22 A service organization is an organization or segment of an organization that provides services 
to user entities, which are likely to be relevant to those user entities’ internal control over financial 
reporting. A user entity is an entity that uses a service organization for which controls at the service 
organization are likely to be relevant to that entity’s internal control over financial reporting. A user 
auditor is an auditor who audits and reports on the financial statements of a user entity. 


6.23 The objectives of the user auditor, when the user entity uses the services of a service 
organization, are to obtain an understanding of the nature and significance of the services provided 
by the service organization and their effect on the user entity's internal control relevant to the audit, 
sufficient to identify and assess the risks of material misstatement; and design and perform audit 
procedures responsive to those risks. If the user auditor is unable to obtain a sufficient understanding 
from the user entity, the user auditor should obtain that understanding from one or more of the 
following procedures: 


¢ Obtaining and reading a System and Organization Controls report, if available; !° 


¢ Contacting the service organization, through the user entity, to obtain specific 
information; 


¢ Visiting the service organization and performing procedures that will provide the 


4 See detailed guidance in AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization. See 
definitions of terms in AT-C 320, Reporting on an Examination of Controls at a Service Organization Relevant to User 
Entities’ Internal Control Over Financial Reporting. 


1S These reports are referred to as System and Organization Controls (SOC) type 1 or type 2 service auditor’s reports, 
which are prepared in accordance with the guidance in AT-C 320. 
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necessary information about the relevant controls at the service organization; and/or 


¢ Using another auditor to perform procedures that will provide the necessary information 
about the relevant controls at the service organization. 


In addition to the requirements set forth in AU-C 402, Audit Considerations Relating to an Entity 
Using a Service Organization, for those service organization controls that are relevant to the audit 
and have been suitably designed and implemented, service organizations must provide its user 
organizations with an auditor’s report (referred to as a type 2 report) on whether: (1) management's 
description of the service organization's system fairly presents the service organization's system that 
was designed and implemented throughout the specified period, (2) the controls related to the control 
objectives stated in the description were suitably designed to provide reasonable assurance that the 
control objectives would be achieved if the controls operated effectively throughout the specified 
period and subservice organizations and user entities applied the complementary controls assumed in 
the design of the service organization’s controls throughout the specified period, and (3) the controls 
operated effectively to provide reasonable assurance that the control objectives stated in the 
description were achieved throughout the specified period if complementary subservice organization 
and user entity controls assumed in the design of the service organization’s controls operated 
effectively throughout the specified period. 


6.24 A user entity may use a service organization that in turn uses a subservice organization to 
provide some of the services provided to a user entity that are relevant to that user entity's internal 
control over financial reporting. In such cases, the objectives of the user auditor are to obtain an 
understanding of the nature and significance of the services provided by the subservice organization 
and their effect on the user entity's internal control relevant to the audit, sufficient to identify and 
assess the risks of material misstatement, and design and perform audit procedures responsive to 
those risks. 


6.25 User entity management should obtain the service auditor's report within a reasonable time to 
allow the auditor of the user entity to consider the results of the service auditor's report during the 
audit of the user entity's financial statements. If the service auditor’s report is not available in an 
appropriate time period as determined by the user auditor or there is a gap between the period 
covered by the service auditor's report and the user entity's year end, the user auditor should consider 
performing the procedures outlined in Paragraph 6.23 above, which may include obtaining a "bridge 
letter" from the service organization which describes updates or changes, if any, in its controls since 
the previous auditor’s report. 


6.26 The user auditor should inquire of management of the user entity about whether the service 
organization has reported to the user entity, or whether the user entity is otherwise aware of, any 
fraud, noncompliance with provisions of laws, regulations, contracts, and grant agreements, or 
uncorrected misstatements at the service organization affecting the financial statements of the user 
entity. The user auditor should evaluate how such matters, if any, affect the user auditor's audit 
procedures, conclusions, and report. 


SECTION 7: REPORTING 
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7.1 An auditor’s report, or separate reports, on the financial statements, internal control over 
financial reporting, and compliance with laws, regulations, contracts, and grant agreements, must be 
prepared at the completion of the audit. The auditor’s report(s) must be submitted to the reporting 
entity head in sufficient time to enable the reporting entity head to meet the due date for submitting 
the audited financial statement, which is defined in A-136. The audit results will be discussed with 
management as soon as practical but, in any case, prior to issuance of the auditor’s report. 


7.2 The auditor’s report(s) must state that the audit was performed in accordance with GAGAS 
and the provisions of this Bulletin. Auditors may refer to AU-C 700, Forming an Opinion and 
Reporting on Financial Statements; AU-C 705, Modifications to the Opinion in the Independent 
Auditor's Report; AU-C 706, Emphasis-of-Matter Paragraphs and Other-Matter Paragraphs in the 
Independent Auditor's Report; AU-C 720, The Auditor’s Responsibilities Relating to Other 
Information Included in Annual Reports; AU-C 730, Required Supplementary Information; chapter 6 
of GAGAS; and the AICPA Audit Guide - Government Auditing Standards and Single Audits 
Chapter 4: Auditor reporting requirements and other communication considerations of government 
auditing standards. (The GAO/CIGIE FAM contains illustrative reports at 595A.) 


Auditor’s Report 


7.3 The auditor’s report(s) must include either an opinion as to whether the reporting entity's 
financial statements are fairly presented in all material respects in accordance with U.S. GAAP, or 
certain modifications as discussed in Paragraph 7.4. 


7.4 The auditor should modify the opinion in the auditor's report when the auditor concludes that, 
based on the audit evidence obtained, the financial statements as a whole are materially misstated or 
the auditor is unable to obtain sufficient appropriate audit evidence to conclude that the financial 
statements as a whole are free from material misstatement. 


¢ The auditor should express a qualified opinion when the auditor, having obtained 
sufficient appropriate audit evidence, concludes that misstatements, individually or in the 
aggregate, are material but not pervasive to the financial statements or the auditor is 
unable to obtain sufficient appropriate audit evidence on which to base the opinion, but 
the auditor concludes that the possible effects on the financial statements of undetected 
misstatements, if any, could be material but not pervasive. 


¢ The auditor should express an adverse opinion when the auditor, having obtained 
sufficient appropriate audit evidence, concludes that misstatements, individually or in the 
aggregate, are both material and pervasive to the financial statements. 


¢ The auditor should disclaim an opinion when the auditor is unable to obtain sufficient 
appropriate audit evidence on which to base the opinion, and the auditor concludes that 
the possible effects on the financial statements of undetected misstatements, if any, could 
be both material and pervasive. 


7.5 If the auditor considers it necessary to draw users’ attention to a matter appropriately 
presented or disclosed in the financial statements that, in the auditor's professional judgment, is of 
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such importance that it is fundamental to users' understanding of the financial statements, the auditor 
should include an emphasis-of-matter paragraph in the auditor's report, provided that the auditor has 
obtained sufficient appropriate audit evidence that the matter is not materially misstated in the 
financial statements. For example, the auditor may choose to include an emphasis-of-matter 
paragraph to discuss a change in accounting principles, identify the nature of the change and refer 
the reader to the note to the financial statements that discusses the change in detail. 


7.6 If the auditor considers it necessary to draw users’ attention to any matter other than those 
appropriately presented or disclosed in the financial statements that, in the auditor's professional 
judgment, is relevant to users' understanding of the audit, the auditor’s responsibilities, or the 
auditor’s report, the auditor should include an other-matter paragraph in the auditor's report. For 
example, the auditor may choose to include an other-matter paragraph to discuss certain situations 
related to prior period financial statements that have been audited by a predecessor auditor or have 
not been audited. 


Reporting on Restatement of Previously Issued Financial Statements 


7.7 When management restates a previously issued financial statement(s) to correct a material 
misstatement, the auditor will perform audit procedures sufficient to reissue or update the auditor's 
report on the restated financial statement(s). The auditor should refer to AU-C 560, 705, 706, and 
708. The auditor must fulfill these responsibilities whether the restated financial statement(s) are 
separately issued or presented on a comparative basis with those of a subsequent period and the 
auditor must evaluate whether the comparability of the financial statements between periods has 
been materially affected by adjustments to correct such material misstatements. As required by AU- 
C 708.14, the auditor must include certain information in an emphasis-of-matter paragraph in the 
reissued or updated auditor's report on the restated financial statement(s). In addition, the emphasis 
of matter paragraph must include, if applicable, a reference to the report on internal control over 
financial reporting containing a discussion of any significant internal control deficiency identified by 
the auditor as having failed to prevent or detect the misstatement and what action management has 
taken to address the deficiency. 


7.8 If at the time of issuance of the auditor's report a material misstatement(s) has been identified 
in any of the previously issued financial statements and the specific amount(s) of the misstatement(s) 
and the related effect(s) of such are unknown, then the auditor will update the auditor's report on the 
previously issued financial statement(s) as appropriate (the auditor should refer to AU-C 560, 705, 
706, and 708). Furthermore, the auditor's report must disclose, at a minimum, the following: 


¢ A statement disclosing that a material misstatement(s) or potential material 
misstatement(s) affects a previously issued financial statement(s) but the specific 
amount(s) of the misstatement(s) and the related effect(s) of such are unknown; 


¢ A reference to the note(s) to the financial statements that discusses the restatement or 
potential restatement; and 


¢ A statement disclosing that a restatement(s) to a previously -issued financial statement(s) 
will or may occur. 


Reporting on Supplementary Information, RSI, Other Information, and Highlights 
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7.9 When providing an opinion on supplementary information (such as consolidating information) 
in relation to the financial statements taken as a whole, the auditor will follow AU-C 725. 


7.10 When reporting on RSJ, the auditor will follow AU-C 730. 
7.11 When reporting on other information in the AFR or PAR, the auditor will follow AU-C 720. 


7.12 When providing an opinion on a “Highlights” or similar summary financial statements, the 
auditor will follow AU-C 810, Engagements to Report on Summary Financial Statements. 


Report on Internal Control Over Financial Reporting 


7.13 If not providing an opinion on internal control, the auditor should state that the auditor 
considered the reporting entity’s internal control over financial reporting to design audit procedures 
that are appropriate in the circumstances for the purpose of expressing an opinion on the financial 
statements, but not for the purpose of expressing an opinion on the effectiveness of internal control. 
(See AU-C 265, Communicating Internal Control Related Matters Identified in an Audit.) 


7.14 Auditors should include in the auditor's report on the financial statements or in a separate 
report (1) significant deficiencies and material weaknesses in internal control over financial 
reporting, (2) a description of the significant deficiencies and material weaknesses and an 
explanation of their potential effects, and (3) a description of the scope of the auditor's testing of 
internal control over financial reporting and whether the tests they performed provided sufficient, 
appropriate evidence to support an opinion on the effectiveness of internal control over financial 
reporting. '® If the auditor identifies any material weakness(es) not reported by the entity in its 
FMFIA Statement of Assurance, the auditor’s report must include a statement to this effect. In the 
event that no material weaknesses were identified during the audit and the auditor is not providing an 
opinion on internal control, the report must state that no deficiencies in internal control were 
identified that were considered to be material weaknesses during the audit of the financial 
statements. (See AU-C 265.) 


7.15 The report must state that the objective either (1) was not to provide an opinion on internal 
control and, therefore, the auditor does not express such an opinion or (2) was to provide an opinion 
on internal control. If the auditor issues a separate report on internal control over financial reporting, 
they should follow GAGAS 6.43. 


7.16 An opinion on internal control over financial reporting can be rendered if desired by the 
agency or mandated by statute. Such an opinion should be issued in accordance with AU-C 940, An 


Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial 
Statements. 


Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements 


16 GAGAS 6.39-6.42. 
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7.17 A report on the reporting entity's compliance with laws, regulations, contracts, and grant 
agreements should include noncompliance with provisions of applicable laws, regulations, contracts, 
and grant agreements identified in the audit that could have a material effect on the financial 
statements. Auditors should include in the auditor's report on the financial statements or in a separate 
report a description of the scope of the auditor's testing of compliance with provisions of laws, 
regulations, contracts, and grant agreements and whether the tests they performed provided 
sufficient, appropriate evidence to support an opinion on compliance with provisions of laws, 
regulations, contracts, and grant agreements. In meeting this requirement, the auditor will list those 
provisions of laws, regulations, contracts, and grant agreements that tests identified reportable 
instances of noncompliance. (See AU-C 250, Consideration of Laws and Regulations in an Audit of 
Financial Statements. See also GAGAS 6.15 for additional requirements pertaining to the 
consideration of compliance with provisions of contracts and grant agreements). 


7.18 When auditors identify or suspect, based on sufficient, appropriate evidence, the following, 
they should include in their report on internal control or compliance the relevant information about: 
(1) fraud that is material, either quantitatively or qualitatively, to the financial statements or other 
financial data significant to the audit objectives; or (2) noncompliance with provisions of law, 
regulation, contracts, or grant agreements that has a material effect on the financial statements or 
other financial data significant to the audit objectives. 


7.19 The report must state either the objective (1) was not to provide an opinion on compliance 
with provisions of applicable laws, regulations, contracts, and grant agreements and, therefore, does 
not express such an opinion, or (2) was to provide an opinion on compliance with provisions of 
applicable laws, regulations, contracts, and grant agreements. If the auditor issues a separate report 
on compliance with provisions of laws, regulations, contracts, and grant agreements, they should 
follow GAGAS 6.43. 


Compliance with FFMIA 


7.20 When testing a reporting entity's compliance with FFMIA, the auditor should refer to Circular 
A-123, Appendix D, Compliance with the Federal Financial Management Improvement Act of 1996. 


(See Circulars | The White House). 


Section 803(b) of FFMIA requires the auditor to report whether the reporting entity's financial 
management systems comply substantially with Section 803(a), which has three requirements. If the 
auditor's tests disclosed no instances in which the reporting entity's systems did not comply 
substantially with all three Section 803(a) requirements, a single statement to this effect is sufficient. 
Where tests disclose that the reporting entity's systems did not comply substantially with one or more 
of the three Section 803(a) requirements, the auditor's mandatory report on compliance, (or an 
accompanying schedule that is referenced in the compliance report) should disclose which of the 
three Section 803(a) requirements for which the reporting entity's systems did not substantially 
comply and group findings together based on the requirement they relate to (i.e., Federal financial 
management systems requirements, applicable Federal accounting standards, or application of the 
USSGL at the transaction level) and, as required by FFMIA: 


¢ Identify the entity or organization responsible for the financial management systems that 
were found not to comply substantially with any one or more of the three Section 803(a) 


21 


requirements; 


¢ Include all facts pertaining to the noncompliance, including the nature and extent of the 
noncompliance, the primary reason or cause of the noncompliance, and any relevant 
comments from reporting entity management or employees responsible for the 
noncompliance; and, 


¢ Provide recommended remedial actions and the time frames to implement such actions. 
Status/Comments/Distribution 


7.21 Auditors should obtain and report the views of responsible officials of the audited entity 
concerning the findings, conclusions, and recommendations, as well as any planned corrective 
actions. (See Paragraphs 6.57-6.60, Obtaining and Reporting the Views of Responsible Officials, of 
GAGAS for further guidance on how to report the views of responsible officials.) 


7.22 Copies of the auditor’s report(s) must be distributed to appropriate agency management for 
inclusion in the reporting entity’s PAR or AFR or the corporation's Management Report. 


Subsequent Discovery of Facts 


7.23 With respect to the subsequent discovery of facts existing at the date of the auditor's report, 
the auditor will follow the steps in See AU-C 560, Subsequent Events and Subsequently Discovered 
Facts. If the auditor concludes that the previously issued auditor’s report is not reliable and action 
should be taken to prevent future reliance on the report, the auditor will communicate such facts to 
the audited entity and advise the audited entity to make the appropriate disclosure of the facts to 
persons who may be relying on the auditor's reports, consistent with Paragraphs 5.5 and 5.6 above. If 
the audited entity fails to do so in a timely manner, the auditor will make the disclosure. 


7.24 Revised financial statements and the auditor's report(s) should be issued as soon as reasonably 
possible after the effect on the previously issued financial statement and auditor's report can be 
determined, consistent with Paragraphs 5.5 and 5.6 above. (See AU-C 560, Subsequent Events and 
Subsequently Discovered Facts, paragraphs 16.b and 17.b.) 


SECTION 8: WRITTEN REPRESENTATIONS FROM MANAGEMENT 


8.1 In accordance with AU-C 580, Written Representations, the auditor will obtain written 
representations from management for the periods covered by the auditors’ report(s). In addition to the 
representations included in AU-C 580, additional representations may be required that are unique to 
the Federal Government. A list of any uncorrected misstatements should be included in or attached 
to the written representations from management. If there are no such uncorrected misstatements, a 
representation to this effect should be included in the written representations from management. In 
accordance with A-136, Section IV.5, the written representations from agencies' management and 
accompanying summary of uncorrected misstatements are required for the audits of entity financial 
statements used to compile the Financial Report of the United States Government (FR). The 
summary of uncorrected misstatements and adjusting entries should be prepared in the standardized 
spreadsheet format shown in the GAO/CIGIE FAM Section 595C, Uncorrected Misstatements and 
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Adjusting Entries, updated in April 2020, and following the guidance in the TFM. 


8.2 The written representations from management must be on the audited entity's letterhead. The 
representations should be dated in accordance with AU-C 580. To ensure the written representations 
from management are prepared timely, a draft letter should be provided to and discussed with 
management as early as possible in the audit and updated for circumstances found throughout the 
audit. 


8.3. The written representations from management must be obtained from the highest levels of the 
audited entity. In accordance with AU-C 580, "[the] auditor should request written representations 
from management with appropriate responsibilities for the financial statements and knowledge of the 
matters concerned." These officials generally should be the head of the reporting entity, the CFO, 
and any others deemed responsible for matters presented in the written representations from 
management. 


8.4 The written representations from management must specify management's materiality 
threshold, or thresholds, if applicable, used for reporting items in the written representations from 
management. Items below this threshold would not be considered exceptions or reported as such in 
the written representations from management.’’ Representations pertaining to potential violations of 
the Antideficiency Act are limited to those that, if true, would have a material effect on the financial 
statements. 


8.5 The representations to be included in the written representations from management are part of 
the evidential matter to be considered by the auditor in its audit of the reporting entity's financial 
statements. AU-C 580 discusses specific representations that should be obtained from management. 
The representations obtained will depend on the circumstances of the engagement and the nature and 
basis of presentation of the financial statements. In addition to the representations given in AU-C 
580, the auditor generally should consider the need to obtain representations on other matters based 
on the circumstances of the audited entity. See also AU-C 725 and AU-C 730 for additional specific 
representations that should be obtained from management regarding supplementary information and 
required supplementary information. Furthermore, auditors may also request representations from 
management regarding other information in documents containing audited financial statements and 
the auditor's report thereon. The auditor should refer to the guidance detailed in the GAO/CIGIE 
FAM Section 1001, Management Representations. The written representations from management 
presented in Appendix E and in the GAO/CIGIE FAM Section 1001A, Example Management 
Representation Letter, should be used as guidance and representations should be customized to the 
situation of the entity being audited or deleted if inapplicable. For significant entities, all 
representations from Appendix E must be included unless the representation contains a conditional 
“if” clause and the condition is not applicable. For significant entities with a calendar year-end, 
include representations 1, 5-21, 27-37, 41-44, 56, and 57 shown in Appendix E, modified as 
necessary. 


8.6 The written representations from management must be consistent with the auditor's report(s). 


17 Management and the auditor should reach an understanding on a materiality level. For guidelines on establishing the 
materiality level for the written representations from management, see the GAO/CIGIE FAM Section 1001, Management 
Representations. 
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If a representation is contradicted by other audit evidence, the auditor will investigate the 
circumstances and consider the reliability of the representation. Based on the circumstances, the 
auditor will then consider whether it is appropriate to rely on other management representations. See 
AU-C 580 paragraphs .22 to .24. 


8.7 For significant entities, notification must be sent by management to OMB, Fiscal Service, 
Main Treasury, and GAO whether there are "no changes" or "changes" due to subsequent changes to 
the written representations from management or subsequent events affecting the agency financial 
statements that have arisen after the written representations from management and financial 
statements have been submitted and before the date of the CFS auditor’s report on the FR. See A- 
136, Section IV.5, Written Representation from Management. 


SECTION 9: LEGAL REPRESENTATION LETTERS AND MANAGEMENT 
SCHEDULES 


9.1 In accordance with AU-C 501, Audit Evidence - Specific Considerations for Selected Items, 
the auditor will seek direct communication with the entity's internal or external (e.g., Department of 
Justice) counsel’® via a letter of inquiry prepared by management to those lawyers with whom 
management consulted concerning litigation, claims, and assessments. '? Responses to the inquiry 
will require management, working with internal counsel, to consult external counsel where lead 
representation was provided by external counsel. (See the GAO/CIGIE FAM Section 1002B, 
Example Legal Letter Request, to include requirements related to AU-C 501, for an illustrative letter 
of inquiry from entity management to legal counsel.) Management should document in a schedule 
how the information contained in the legal counsel's response(s) was considered in preparing the 
financial statements. (See Paragraph 9.3.) 


9.2. Legal counsel will consider the guidance contained in the American Bar Association's 
Statement of Policy Regarding Lawyers' Responses to Auditors' Request for Information (December 
1975) in preparing their responses. (Refer to the Department of Justice website for guidance 
preparing a legal letter, Documents and Forms (justice.gov) and see the GAO/CIGIE FAM Section 
1002C, Example Legal Representation Letter, for an illustrative response letter from legal counsel to 
the auditor.) 


9.3 To satisfy management's responsibilities under SFFAS No. 5, Accounting for Liabilities of the 
Federal Government, as amended, related to contingent liabilities arising from litigation, and to 
facilitate the audit thereof, the CFO must prepare a schedule to document how the information 
contained in the legal counsel's response was considered in preparing the financial statements. (See 
the GAO/CIGIE FAM Section 1002D, Example Management Summary Schedule, and the 
management schedule referenced in the TFM 2-4700, Section 4707.10, for the format to be used for 
the management schedule.) 


9.4 The timing of legal letter requests, responses, and related management's schedules must be 


18 See GAO/CIGIE FAM Section 1002.21-23, Legal Counsels from Whom Information Should be Requested. 
19 Management and the auditor should agree on a materiality level to use in the letter of inquiry. For guidelines on setting the 
materiality level for the legal letter, see the GAO/CIGIE FAM Section 1002, Inquiries of Legal Counsel. 
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coordinated between entity legal counsel, entity management, and the auditor. Legal counsel should 
specify the effective date of the legal representation response. The management schedule should be 
provided as soon as practical after the legal letter response is provided to the auditor. 


9.5 Updated legal responses must only include changes from the interim responses or a statement 
that there are no changes. Updated management schedules must be comprehensive (reflecting the 
interim schedule plus any changes), and the auditor may use the work performed on the interim 
schedule when verifying the updated schedule. 


9.6 For significant entities, after applying applicable audit procedures, interim and updated (final) 
legal letters and management schedules must be submitted by the OIG to Fiscal Service, DOJ and 
GAO no later than the dates established in the TFM 2-4700, Reporting and Submission Dates. The 
OIG must inform GAO, DOJ, and Fiscal Service whether there were “no changes” or “changes” due 
to subsequent events that resulted in changes in the likelihood of loss or amount of loss for cases, or 
both, after the effective date of the final legal representation letter but before the CFS auditor’s 
report date (per AU-C 230, Audit Documentation). Contact information for these agencies can be 
found in A-136, Appendix B. 


SECTION 10: COMMUNICATING OTHER DEFICIENCIES 


10.1 As codified in AU-C 265, the auditor may identify other deficiencies in internal control that 
are not significant deficiencies or material weaknesses, but that may be of sufficient importance to 
merit management's attention based on the auditor's professional judgment. The auditor should 
communicate, in writing or orally, these other deficiencies to management at an appropriate level of 
responsibility, on a timely basis. If other deficiencies in internal control are communicated orally, the 
auditor should document the communication. See 7.14 in regard to reporting material weaknesses 
and significant deficiencies. 


SECTION 11: AGREED-UPON PROCEDURES: RETIREMENT, HEALTH 
BENEFITS, AND LIFE INSURANCE WITHHOLDINGS/CONTRIBUTIONS 
AND SUPPLEMENTAL SEMIANNUAL HEADCOUNT REPORT SUBMITTED 
TO THE OFFICE OF PERSONNEL MANAGEMENT (OPM) 


11.1 The Agreed-Upon Procedures (AUPs) must be performed annually in accordance with AT-C 
215, Agreed-Upon Procedures Engagements, as amended by SSAE 19, Agreed-Upon Procedures 
Engagements, and GAGAS Chapter 7. The AUPs are designed for the intended purpose of assisting 
OPM in assessing the reasonableness of the Retirement, Health Benefits, and Life Insurance 
withholdings/contributions as well as semiannual headcount information submitted by agencies. The 
appropriateness of the procedures is solely the responsibility of the CFO of OPM and must be 
applied to the 12 months ended August 31 of each year. 


11.2 Refer to Reports | Office of Personnel Management (opm.gov) for the current AUPs required by 
OPM. 


11.3 The auditor of each payroll provider will apply the AUPs separately (1) for each entity 
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designated as subject to the CFO Act in Appendix A, and (2) each entity not designated as subject to 
the CFO Act that has 30,000 or more employees. 


11.4 Although the auditor must perform the AUPs separately for each applicable entity, the auditor 
will combine the results into a single report. 


11.5 The auditor of the payroll provider is the auditor responsible for the purpose of performing the 
AUPs. The auditors of customer agencies will participate to the extent necessary to ensure that the 
AUPs are performed effectively and within the established time frames. 


11.6 In light of the migration of payroll servicing responsibilities under the e-Payroll initiative, the 
payroll provider as of March 31 will be responsible for assuring that the AUPs are performed and 
reported upon. 


11.7 The report on the performance of the AUPs must be submitted no later than October 1. To the 
extent practical, management's comments on the auditor's findings must be included in the report. 


11.8 Ifaspecific AUP cannot be performed, the auditor must propose to OPM's CFO, in writing 
no later than July 15 at the email address referenced in 11.10 below, an alternative procedure that 
would accomplish the AUP’s intended purpose. OPM CFO must acknowledge whether the 
alternative procedure is appropriate for OPM’s intended purpose. In addition, auditors must notify 
OPM's CFO by September 3 of any other anticipated difficulties in completing the procedures and 
submitting the required report by October 1. 


11.9 The auditor of the payroll provider is required to report all findings to OPM by adhering to 
AT-C 215, as amended by SSAE 19, and GAGAS Chapter 7. This will assist and enhance OPM's 
ability to track each finding for all agencies. 


11.10 Agencies must submit the report on the application of these procedures by email as a PDF to 
FinancialBALS@opm.gov. 


SECTION 12: INSPECTOR GENERAL OVERSIGHT 


12.1 Section 4(b) of the IG Act of 1978, as amended, requires OIGs to establish guidelines to 
determine when it is appropriate to use non-Federal auditors such as IPAs. The IG Act also requires 
OIGs take appropriate steps to assure that any work performed by the non-Federal auditors comply 
with GAGAS. When the OIG uses non-Federal auditors to perform the reporting entity's financial 
statement audit, the OIG must: 


¢ Provide oversight, technical advice, and liaison to non-Federal auditors; 


e Ensure that audits and auditor’s report(s) are completed timely and in accordance with the 
requirements of GAGAS, this Bulletin, and other applicable professional auditing 
standards; 


¢ Document oversight activities and monitor audit status; and 


¢ Review responses to auditor’s report(s) and report significant disagreements to the audit 
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follow- up official per OMB Circular A-50, Audit Follow-up. 


12.2 The OIG is encouraged to use applicable provisions of GAO/CIGIE FAM Section 670, IG 
Oversight of Audits Performed by Contracted Independent Public Accounting (IPA) Firms, which 
provides guidance on designing procedures for the oversight of IPA firms contracted to perform 
financial statement audits and to assure that the IPA firms comply with the audit standards 
established by the Comptroller General of the United States. 


SECTION 13: SIGNIFICANT DUE DATES AND CONTACT INFORMATION 
FOR FINANCIAL STATEMENTS AND RELATED REPORTS 


13.1 Fora complete list of year-end financial reports and their respective due dates, please refer to 
A-136, Part I.5, Submission Deadlines and the TFM, Volume 1, Part 2, Section 4700. In addition, 


contact information is provided in A-136, Appendix B. 
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APPENDIX A: CFO ACT AGENCIES 


EXECUTIVE DEPARTMENTS AND AGENCIES 
SUBJECT TO THE CHIEF FINANCIAL OFFICERS (CFO) ACT 
REQUIRED TO PREPARE FINANCIAL STATEMENTS 


Department of Agriculture 

Department of Commerce 

Department of Defense 

Department of Education 

Department of Energy 

Department of Health and Human Services 
Department of Homeland Security 

Department of Housing and Urban Development 
Department of the Interior 

Department of Justice 

Department of Labor 

Department of State 

Department of Transportation 

Department of the Treasury 

Department of Veterans Affairs 

Environmental Protection Agency 

General Services Administration 

National Aeronautics and Space Administration 
National Science Foundation 

Office of Personnel Management 

Small Business Administration 

Social Security Administration 

United States Agency for International Development 
United States Nuclear Regulatory Commission 
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APPENDIX B: COMPONENT ENTITIES 


COMPONENTS OF EXECUTIVE DEPARTMENTS AND AGENCIES 
REQUIRED TO PREPARE FINANCIAL STATEMENTS” 


Department of Agriculture 
Rural Development Mission Area 


Department of Defense 
Department of the Army General Funds 


Department of the Air Force General Funds 

U.S. Marine Corps General Funds?" 

U.S. Navy General Funds 

Military Retirement Fund 

U.S. Army Corps of Engineers Civil Works Program 
Department of the Army Working Capital Fund 
Department of the Navy Working Capital Fund 
Department of the Air Force Working Capital Fund 


Department of Health and Human Services 
Centers for Medicare & Medicaid Services 


Department of Transportation 
Federal Aviation Administration 


Department of the Treasury 
Internal Revenue Service 


Office of Personnel Management 
Civil Service Retirement and Disability Fund 
Federal Employees Health Benefits Program 
Federal Employees Life Insurance Program 


20 The requirement for components to prepare financial statements may be satisfied by presenting the components separately 
in consolidated agency-wide financial statements and conducting an audit, in accordance with this Bulletin, at the 
consolidated agency-wide financial statement level. 
21 For FY 2022, the U.S. Marine Corps will not prepare audited financial statements, but will provide unaudited data to the 
U.S. Navy that will be incorporated into the Department of Defense’s financial statements. This is expected to allow the 
Marine Corps to conduct continuous audit procedures through the fourth quarter of FY 2022 and to lead to an opinion on the 
FY 2023 financial statements. 
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APPENDIX C: ATDA AGENCIES 


EXECUTIVE AGENCIES 
SUBJECT TO THE ACCOUNTABILITY OF TAX DOLLARS ACT (ATDA) 
REQUIRED TO PREPARE FINANCIAL STATEMENTS 


Access Board (f/k/a Architectural and Transportation Barriers Compliance Board) 

Administrative Conference of the United States 

Advisory Council on Historic Preservation 

American Battle Monuments Commission 

Appalachian Regional Commission 

Armed Forces Retirement Home 

Barry Goldwater Scholarship and Excellence in Education Foundation 

Central Intelligence Agency 

Chemical Safety and Hazard Investigation Board 

Commission for the Preservation of America's Heritage Abroad 

Commission of Fine Arts 

Committee for Purchase from People Who Are Blind or Severely Disabled (U.S. Ability One 
Commission) 

Commodity Futures Trading Commission 

Consumer Financial Protection Bureau 

Consumer Product Safety Commission 

Council of the Inspectors General on Integrity and Efficiency 

Court Services and Offender Supervision Agency for DC 

Defense Nuclear Facilities Safety Board 

Delta Regional Authority 

Denali Commission 

Election Assistance Commission 

Equal Employment Opportunity Commission 

Farm Credit Administration 

Farm Credit System Insurance Corporation 

Federal Communications Commission 

Federal Election Commission 

Federal Financial Institutions Examination Council Appraisal Subcommittee 

Federal Housing Finance Agency 

Federal Labor Relations Authority 

Federal Maritime Commission 

Federal Mediation and Conciliation Service 

Federal Mine Safety and Health Review Commission 

Federal Retirement Thrift Investment Board 

Federal Trade Commission 

Gulf Coast Ecosystem Restoration Council 

Harry S. Truman Scholarship Foundation 

Institute of American Indian and Alaska Native Culture and Arts Development 
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Institute of Museum and Library Services 
Intelligence Community Management Account 
International Trade Commission 

James Madison Memorial Fellowship Foundation 
Japan-United States Friendship Commission 
Marine Mammal Commission 

Merit Systems Protection Board 

Morris K. Udall and Stewart L. Udall Foundation 
National Archives and Records Administration 
National Capital Planning Commission 

National Council on Disability 

National Credit Union Administration 

National Endowment for the Arts 

National Endowment for the Humanities 

National Labor Relations Board 

National Mediation Board 

National Transportation Safety Board 

Northern Border Regional Commission 

Nuclear Waste Technical Review Board 
Occupational Safety and Health Review Commission 
Office of Government Ethics 

Office of Navajo and Hopi Indian Relocation 

Office of Special Counsel 

Peace Corps 

Postal Regulatory Commission 

Privacy and Civil Liberties Oversight Board 
Railroad Retirement Board 

Securities and Exchange Commission 

Selective Service System 

Smithsonian Institution (SI) 

SI/John F. Kennedy Center for the Performing Arts 
SI/National Gallery of Art 

SI/Woodrow Wilson International Center for Scholars 
Surface Transportation Board 

U.S. Agency for Global Media (f/k/a Broadcasting Board of Governors) 
United States Commission on Civil Rights 

United States Court of Appeals for Veterans Claims 
United States Holocaust Memorial Museum 

United States Interagency Council on Homelessness 
United States Trade and Development Agency 
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APPENDIX D: GOVERNMENT CORPORATIONS 


GOVERNMENT CORPORATIONS 
REQUIRED TO PREPARE FINANCIAL STATEMENTS 


Commodity Credit Corporation 

Community Development Financial Institutions Fund 
Corporation for National and Community Service (a/k/a AmeriCorps) 
Export-Import Bank of the United States 

Federal Crop Insurance Corporation 

Federal Deposit Insurance Corporation 

Federal Financing Bank 

Federal Home Loan Banks 

Federal Housing Administration 

Federal Prison Industries, Incorporated 

Financing Corporation 

Government National Mortgage Association 

Inter-American Foundation 

Millennium Challenge Corporation 

National Credit Union Administration Central Liquidity Facility 
Pension Benefit Guaranty Corporation 

Presidio Trust 

Resolution Funding Corporation 

Saint Lawrence Seaway Development Corporation 

Tennessee Valley Authority 

United States African Development Foundation 

United States International Development Finance Corporation 
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APPENDIX E: ILLUSTRATIVE REPRESENTATIONS 


ILLUSTRATIVE WRITTEN REPRESENTATIONS FROM MANAGEMENT FOR THE 
FINANCIAL STATEMENTS 


[Entity Letterhead] 
[Date of Auditor's Report and Completion of the Audit] 


[Name and Title of Audit Organization Head] 
[Address of Audit Organization] 


Dear [Name of Audit Organization Head]: 


We are providing this letter in connection with your integrated [if expressing an opinion on the 
effectiveness of internal control over financial reporting] audits of the balance sheets of [name of 
entity] as of September 30, 20X2 and 20X1, [or the dates of the audited financial statements] and the 
related statements of net costs, changes in net position, budgetary resources, and custodial activity [if 
custodial activity is reported] for the years then ended, and [if social insurance is reported] the [years 
presented] statements of social insurance (SOSI) and the statements of changes in social insurance 
amounts (SCSIA) for the years ended [dates presented], and the related notes to the financial 
statements, hereinafter referred to as the "financial statements." 


Certain representations in this letter are described as being limited to matters that are material. Items 
are considered material, regardless of size, if they involve an omission or misstatement of accounting 
information that, in the light of surrounding circumstances, makes it probable that the judgment of a 
reasonable person relying on the information would be changed or influenced by the omission or 
misstatement. 


Except where otherwise stated below, immaterial matters less than $[Insert amount] collectively are 
not considered to be exceptions that require disclosure for the purpose of the following 
representations. This amount is not necessarily indicative of amounts that would require adjustment 
to or disclosure in the financial statements. Such quantitative materiality considerations do not apply 
to representations that are not directly related to amounts included in the financial statements, 
required supplementary information (RSI)*? [if RSI is presented] and other information (OI)”? [if OI 
is presented]. 


We confirm, as of [date of auditor's report], the following representations made to you during your 
audits. These representations pertain to both years’ financial statements and update the representations 
we provided in the prior year. 


2 RSI consists of [insert description]. 


?3 OI consists of [insert description]. 
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Financial Statements, RSI and Other Information 


1. We have fulfilled our responsibilities, as set out in the terms of the audit engagement letter dated 
[insert date of engagement letter], for the preparation and fair presentation of the financial 
statements, including accompanying notes, in accordance with U.S. generally accepted 
accounting principles (GAAP), issued by [name of standard setter, such as Federal Accounting 
Standards Advisory Board (FASAB) or Financial Accounting Standards Board (FASB)]. The 
financial statements are fairly presented in accordance with U.S. GAAP. [If there are departures 
from generally accepted accounting principles, this statement should be modified to disclose all 
known instances of departure. ] 


2. We have fulfilled our responsibility for the presentation of supplementary information in 
accordance with the applicable criteria and prescribed guidelines and the following: [Delete 
this item if the auditor is not engaged to report on whether supplementary information is 
fairly stated, in all material respects, in relation to the financial statements as a whole.] 


a. The supplementary information is fairly presented in accordance with the applicable 
criteria and prescribed guidelines. 


b. There are no changes in the methods of measurement or presentation of the 
supplementary information from the prior year that have not been disclosed to you, 
including the reasons for such changes. [If there were no such changes, the underlined 
text should be omitted. ] 

c. There are no significant assumptions or interpretations underlying the measurement or 


presentation of the supplementary information that have not been disclosed to you. [If 
there are no assumptions or interpretations, the underlined text should be omitted. ] 


3. [If RSI is presented] We have fulfilled our responsibilities for the measurement, preparation, 
and presentation of the RSI in accordance with prescribed guidelines established in U.S. 
GAAP. 

a. The RSI is measured and presented in accordance with prescribed guidelines in U.S. 
GAAP and is consistent with the financial statements and contain no material 
misstatement of fact. 

b. There are no changes in the methods of measurement or presentation of the RSI from 
the prior year that have not been disclosed to you including the reasons for such 
changes. [If there were no such changes, the underlined text should be omitted.] 

c. There are no significant assumptions or interpretations underlying the measurement or 


presentation of the RSI that have not been disclosed to you. [If there are no 
assumptions or interpretations, the underlined text should be omitted. ] 


4. [If Ol is presented] We have fulfilled our responsibilities for the preparation and presentation 
of the OI included in documents containing the audited financial statements and auditor's 
report, and for ensuring the consistency of that information with the audited financial 
statements and RSI. 


a. The OI included in the document containing the audited financial statements and 


auditor's report is consistent with the financial statements and RSI and contains no 
material misstatement of fact. 

There are no changes in the methods of measurement or presentation of the OI from the 
prior year that have not been disclosed to you, including the reasons for such changes. [If 
there were no such changes, the underlined text should be omitted. ] 

There are no significant assumptions or interpretations underlying the measurement or 
presentation of the OI that have not been disclosed to you. [If there are no assumptions 
or interpretations, the underlined text should be omitted. ] 


5. Significant assumptions that we used in making accounting estimates, including those measured 
at fair value, are reasonable. 


6. We have provided you with all relevant information and access, as agreed upon in the terms of 
the audit engagement letter, including the following: 


a. 


Cs 


d. 


access to all information that is relevant to the preparation and fair presentation of the 
financial statements, such as records, documentation, and other matters; 

additional information that you have requested from us for the purpose of the audit, 
including, but not limited to: 

I. minutes of meetings, or summaries of actions of recent meetings for which 


minutes have not been prepared, of the [Board of Directors or other similar 
bodies of those charged with governance] and 


II. | any communications from the Office of Management and Budget (OMB) or the 


Department of the Treasury’s Bureau of the Fiscal Service concerning 
noncompliance with, or deficiencies in, financial reporting practices; 


unrestricted access to and full cooperation of personnel within the entity from whom 
you determined it necessary to obtain audit evidence; and 


all reports obtained from the [Entity's] service organizations. 


7. Except as disclosed to you in writing, there have been none of the following: 


da. 


Circumstances that have resulted in communications from the [Entity's] legal counsel 
reporting evidence of a material violation of law or breach of fiduciary duty, or similar 
violations by the [Entity] of any agent thereof. 

Communications from regulatory/oversight agencies (such as OMB and GAO), other 
government entities or agencies, governmental representatives, employees, or others 
concerning investigations or allegations of noncompliance with laws or regulations, 
deficiencies in financial reporting practices, or other matters that could have a material 
adverse effect on the financial statements, supplementary information, RSI and OI. 


8. All transactions have been recorded in the accounting records and are reflected in the financial 
statements. 


There are no uncorrected misstatements in the financial statements, as we have corrected the 


financial statements for any misstatements you have identified during the audit and communicated 
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10. 


bay 


des 


rS. 


14. 


15. 


16. 


17. 


18. 


to us. OR The effects of uncorrected financial statement misstatements in the attached summary 
are immaterial, both individually and in the aggregate, to the financial statements taken as a 
whole. (Note: As discussed in AU-C 580.A12, if management believes that certain of the 
identified items are not misstatements, management's belief may be acknowledged by adding to 
the representation, for example, "We believe that items XX and XX do not constitute 
misstatements because [description of reason].") 


[Entity] has satisfactory title to all owned assets, including stewardship land and heritage 
assets. There are no liens or encumbrances on these assets and no assets have been pledged. 
OR [Entity] has satisfactory title to all owned assets. There are no liens or encumbrances on 
these assets and no assets have been pledged. [Entity] has no stewardship land or heritage 
assets. 


We have no plans or intentions that may materially affect the recognition, measurement, 
presentation, disclosure, or classification of assets and liabilities. 


We have disclosed to you the identities of [Entity's] disclosure entities, related parties, and 
public-private partnerships, and all the relationships and transactions related to them. 


Relationships and transactions with disclosure entities, related parties, and public-private 
partnerships have been appropriately accounted for and disclosed in the financial statements in 
accordance with U.S. GAAP and do not prevent the financial statements from achieving fair 
presentation. 


Guarantees under which [Entity] is contingently liable have been properly reported or 
disclosed. OR There are no guarantees under which [Entity] is contingently liable that 
require reporting or disclosure in the financial statements. 


We have disclosed to you all known actual or possible litigation, claims, and assessments, 
including those related to treaties and other international agreements, whose effects should be 
considered when preparing the financial statements. OR We are not aware of any pending or 
threatened litigation and claims whose effects should be considered when preparing the 
financial statements. 


The effects of all known actual or possible litigation, claims, and assessments, including those 

related to treaties and other international agreements, have been accounted for and disclosed in 
the financial statements in accordance with U.S. GAAP [or other applicable financial reporting 
framework]. 


All events or transactions subsequent to September 30, 20X2 [or date of latest audited financial 
statements], and for which U.S. GAAP requires adjustment or disclosure have been adjusted or 
disclosed in the financial statements. 


We have properly recorded or disclosed in the financial statements changes in accounting 
principle that affect the consistency of the financial statements between the periods presented. 
OR There are no changes in accounting principle that affect the consistency of the financial 
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statements between the periods presented. 


Intragovernmental Activities 


19. All intra-entity transactions and balances have been appropriately identified and eliminated for 
financial reporting purposes [If no intra-entity transactions or balances, replace with: “There are 
no intra-entity transactions or balances” ]. All intragovernmental transactions and activities have 
been appropriately identified, recorded, and disclosed in the financial statements. There are no 
[OR “There are”] material unresolved differences in intragovernmental transactions and 
balances with Federal entity trading partners and appropriate adjustments have been made to 
address reconciling items. 


Internal Control 


20. We acknowledge our responsibility for maintaining effective internal control over financial 
reporting, including the design, implementation, and maintenance of internal control relevant to 
the preparation and fair presentation of financial statements that are free from material 
misstatement, whether due to fraud or error. 


21. We have fulfilled our responsibility for maintaining effective internal control over financial 
reporting. We have fulfilled our responsibility for the design, implementation, and maintenance 
of internal control relevant to the preparation and fair presentation of financial statements that 
are free from material misstatement, whether due to fraud or error. 


22. Weare responsible for evaluating the effectiveness of internal control over financial reporting 
based on the criteria established under 31 U.S.C. § 3512 (c), (d) (commonly known as the 
Federal Managers' Financial Integrity Act) [or other appropriate criteria], and providing our 
assessment of the effectiveness of internal control over financial reporting as of [date of most 
recent financial statement presented], based on our evaluation. (This item is optional if the 
auditor is not opining on internal control. Also, if the agency bases its internal control 
assessment on suitable criteria other than 31 U.S.C. § 3512(c), (d), cite the criteria used (for 
example, Internal Control-Integrated Framework issued by the Committee of Sponsoring 
Organizations of the Treadway Commission (COSO)).) 


23. We evaluated the effectiveness of [Entity's] internal control over financial reporting as of 
September 30, 20X2 [or date of latest audited financial statements], based on the criteria 
established under 31 U.S.C. 3512 (c), (d) (commonly known as the Federal Managers' 
Financial Integrity Act). [Entity's] internal control over financial reporting is a process effected 
by those charged with governance, management, and other personnel, the objectives of which 
are to provide reasonable assurance that (1) transactions are properly recorded, processed, and 
summarized to permit the preparation of financial statements in accordance with U.S. GAAP, 
and assets are safeguarded against loss from unauthorized acquisition, use, or disposition, and 
(2) transactions are executed in accordance with provisions of applicable laws, including those 


*4 Tf the auditor is opining on internal control, the date must be the date of the opinion. However, management may choose to 
include this representation even if the auditor is not opining on internal control. If that occurs, the date must be the date of 
management’s assurance statement in accordance with OMB Circular A-123. 
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24. 


25. 


26. 


27. 


28. 


29; 


governing the use of budget authority; regulations; contracts; and grant agreements 
noncompliance with which could have a material effect on the financial statements. 


[This item is optional if the auditor is not opining on internal control. Also, if the agency bases 
its internal control assessment on suitable criteria other than 31 U.S.C. § 3512(c), (d), cite the 
criteria used (for example, COSO’s Internal Control — Integrated Framework). ] 


We did not use [auditor's] audit procedures performed during the integrated audit of [Entity's] 
20X2 and 20X1 financial statements as part of the basis for our assessment about [Entity's] 
internal control over financial reporting as of September 30, 20X2 [or date of latest audited 
financial statements]. [Delete this item if the auditor is not opining on internal control.] 


Based on the evaluation in number 23, we conclude that as of September 30, 20X2 [or date of 
latest audited financial statements], [Entity's] internal control over financial reporting was 
effective. [Delete this item if the auditor is not opining on internal control. ] 


If there are material weaknesses: Based on the evaluation in number 23, we conclude that as of 
September 30, 20X2 [or date of latest audited financial statements], [Entity's] internal control 
over financial reporting was not effective because of the effects of the material weaknesses 
discussed below [or in an attachment]. 


We have disclosed to you all [or, There are no] deficiencies in the design or operation of internal 


control over financial reporting as of September 30, 20X2 [or date of latest audited financial 
statements], and we have separately disclosed all such deficiencies that we believe to be 
significant deficiencies or material weaknesses. [Delete this item if the auditor is not opining on 
internal control. ] 


We have disclosed to you all significant deficiencies and material weaknesses in the design or 
operation of internal control over financial reporting that existed at any time during the years 
ended [date of most recent financial statement presented], and [date of prior year financial 
statement presented], and indicated which deficiencies were corrected by [date of most recent 
financial statement presented]. 


All significant deficiencies and material weaknesses identified and communicated to us by 
[auditor] in prior years' audits that remained unresolved as of September 30, 20X1 [or date of 
prior year audited financial statements], have been resolved OR [indicate specifically any that 
have not been resolved] as of September 30, 20X2 [or date of latest audited financial 
statements]. 


If there were no significant deficiencies or material weaknesses: During the audit of the 
financial statements for the year ended September 30, 20X1 [or date of prior year audited 
financial statements], [auditor] did not communicate any significant deficiencies or material 
weaknesses to us. 


We have identified to you all previous audits, attestation engagements, and other studies that 
relate to the objectives of this audit, including whether related recommendations have been 
implemented. 
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30. There have been no changes to internal control over financial reporting subsequent to 
September 30, 20X2 [or date of latest audited financial statements], or other conditions that 
might significantly affect internal control over financial reporting. [If there were changes, 
describe them, including any corrective actions taken with regard to any significant 
deficiencies or material weaknesses. | 


Fraud 


31. We acknowledge our responsibility for the design, implementation, and maintenance of effective 
internal control to prevent and detect fraud. 


32. We have fulfilled our responsibility for the design, implementation, and maintenance of internal 
control to prevent or detect fraud. 


33. We have [no knowledge of any] OR [disclosed to you all information that we are aware of 
regarding] fraud or suspected fraud that affects the entity and involves (1) management; (2) 
employees who have significant roles in internal control over financial reporting, or (3) others 
when the fraud could have a material effect on the financial statements. [If there is knowledge 
of any instances, including those that do not result in a material misstatement to the financial 
statements, describe them. ] 


34. We have [no knowledge of any] OR [disclosed to you all information that we are aware of 
regarding] fraud or suspected fraud that resulted in a material misstatement to [Entity’s] 
financial statements or RSI. 


35. We have [no knowledge of any] OR [disclosed to you all information that we are aware of 
regarding] allegations of fraud or suspected fraud affecting the financial statements 
communicated by employees, former employees, or others. 


36. We have disclosed to you the results of our assessment of the risk that the financial statements 
may be materially misstated as a result of fraud. 


37. We have no knowledge of any officer of [Entity], or any other person acting under the 
direction thereof, having taken any action to fraudulently influence, coerce, manipulate, or 
mislead you during your audit. 


Compliance of Systems with FFMIA 


[If a CFO Act agency, which is subject to the Federal Financial Management Improvement Act of 
1996 (FFMIA)] 


38. We are responsible for implementing and maintaining financial management systems that 
comply substantially with Federal financial management systems requirements, Federal 
accounting standards (U.S. GAAP), and application of the U.S. Government Standard General 
Ledger (USSGL) at the transaction level. 


39. 


40. 


We have assessed the financial management systems to determine whether they comply 
substantially with Federal financial management systems requirements, Federal accounting 
standards, and application of the USSGL at the transaction level. Our assessment was based on 
OMB guidance. 


[Entity's] financial management systems complied substantially with Federal financial 
management systems requirements, Federal accounting standards, and application of the USSGL 
at the transaction level as of [date of the latest financial statements]. 


[If the financial management systems comply substantially with only one or two of the above 
elements, modify as follows: ] 


As of [date of financial statements], [Entity's] financial management systems comply 
substantially with [specify which of the three elements comply substantially (e.g., Federal 
accounting standards and application of the USSGL at the transaction level)], but did not comply 
substantially with [specify which of the three elements do not comply substantially (e.g., Federal 
financial management systems requirements)], as described below [or in an attachment]. 


[If the financial management systems do not comply substantially with any of these three 
elements, use the following paragraph: ] 


As of [date of financial statements], [Entity's] financial management systems do not comply 
substantially with the Federal financial management systems requirements, applicable Federal 
accounting standards, and application of the USSGL at the transaction level. 


[If the financial management systems do not comply substantially with one or more of the three 
elements, the representation should (1) identify the entity or organization responsible for the 
financial management systems that were found to not comply substantially with any of the three 
elements; (2) identify all the facts pertaining to the noncompliance, including the nature and 
extent of the noncompliance and the primary reason or cause of the noncompliance; and (3) 
indicate whether the remediation plan that includes the resources, remedies, and intermediate 
target dates necessary to bring the agency's financial management systems into substantial 
compliance has been provided to the auditor or has not been prepared. | 


Compliance with Applicable Laws, Regulations, Contracts, and Grant Agreements 


41. 


42. 


43. 


We are responsible for complying with laws, regulations, contracts, and grant agreements 
applicable to [Entity]. 


We have identified and disclosed to you all provisions of laws, regulations, contracts, and grant 
agreements applicable to [Entity], noncompliance with which could have a material effect on 
the financial statements. 


There are no instances of noncompliance or suspected noncompliance with laws, regulations, 
contracts, and grant agreements applicable to [Entity] whose effects should be considered when 
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44. 


preparing the financial statements. OR [We have disclosed to you all instances of 
noncompliance or suspected noncompliance with laws, regulations, contracts, and grant 
agreements applicable to [Entity] whose effects should be considered when preparing financial 
statements. ] 


We are not aware of any violations, or potential violations, of the Antideficiency Act for the 
years ended September 30, 20X2 and 20X1, and through the date of this letter. OR We have 
communicated to you all violations of the Antideficiency Act for the years ended September 30, 
20X2 and 20X1, and through the date of this letter and [, except for {add list of known ADA 
violations that do not have a material effect on the financial statements},] such violations have 
or could have a material effect on the financial statements for the years ended September 30, 
20X2 and 20X1. In addition, we have communicated to you all potential violations of the 
Antideficiency Act for the years ended September 30, 20X2 and 20X1, and through the date of 
this letter that, if true, could have a material effect on the financial statements for the years 
ended September 30, 20X2 and 20X1. 


Statement of Social Insurance and Statement of Changes in Social Insurance Amounts 


[If a Statement of Social Insurance (SOSI) and a Statement of Changes in Social Insurance Amounts 
(SCSIA) are presented, see AICPA publication SOP 04-1, Auditing the Statement of Social Insurance, 
(SOP 04-1 § 39) which suggests the following management representations. ] 


45. 


46. 


47. 


48. 


49. 


Management is responsible for the assumptions and methods used in the preparation of the SOSI 
and SCSIA. Management agrees with the actuarial methods and assumptions that [Entity's] 
actuary used and has no knowledge or belief that would make such methods or assumptions 
inappropriate in the circumstances. Management did not give any instructions, or cause any 
instructions to be given to [Entity's] actuary with respect to values or amounts derived, and is not 
aware of any matters that have affected the objectivity of [Entity's] actuary. Management 
believes that the actuarial assumptions and methods used to measure the amounts in the SOSI 
and SCSIA for financial accounting purposes are appropriate in the circumstances. 


Actuarial assumptions and methods used to measure the amounts in the SOSI and SCSIA for 
financial accounting and disclosure purposes represent management's reasonable estimates 
regarding future events based on demographic and economic assumptions and future changes 
mandated by law. 


There were no material omissions from the data provided to [Entity's] actuary for the purpose of 
determining the actuarial present value of the estimated future income to be received and 
estimated future expenditures to be paid during the projection period sufficient to illustrate the 
long-term sustainability of [name of the social insurance program] as of [dates of SOSI 
presented]. 


The SOSI covers a projection period sufficient to illustrate the long-term sustainability of the 
social insurance program. 


Management provided the auditor with all the reports developed by external review groups 
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appointed by [Entity's or the program's trustees] related to estimates in the SOSI. 


50. The following matters relating to the SOSI have been disclosed properly in the notes to the 


51. 


52. 


53. 


financial statements: 
a. The accumulated excess of all past cash receipts, including interest on investments, 
over all past cash disbursements within the social insurance program represented by the 
fund balance at the valuation date. 


b. An explanation of how the net present value is calculated for the closed group. 


c. Comparative financial information for items in paragraphs 2a, 2b, 2c, and 2d (1) of 
SOP 04-1, for the current year and for each of the preceding 4 years. (Note any 
preceding years that are unaudited.) 


d. Significant assumptions used in preparing estimates. 


There have been no changes in [OR Changes in the following have been properly reported or 
disclosed in] the actuarial methods or assumptions used to calculate amounts recorded or 
disclosed in the financial statements between the 
a. valuation dates of (for example: January 1, 20X2, and January 1, 20X1, and 
other valuation dates presented) or changes in the method of collecting data and 
b. valuation date of (for example: January 1, 20X2) and the financial reporting date of 
(September 30, 20X2) or changes in the method of collecting data. 


There have been no changes in [OR, Changes in the following have been properly reported 
or disclosed in] laws and regulations affecting social insurance program income and benefits 
between the 
a. valuation dates of (for example: January 1, 20X2, and January 1, 20X1, and 
other valuation dates presented) and 
b. valuation date of (for example: January 1, 20X2) and the financial reporting date of 
(September 30, 20X2). 


Accounting estimates applicable to the financial information of [Entity] included in the SOSI and 
SCSIA are based on management's reasonable estimate, after considering past and current events 
and assumptions about future events. 


Budgetary and Restricted Funds 


D4. 


5D: 


[If a Statement of Budgetary Resources is presented] The information presented in the [Entity's] 
Statement of Budgetary Resources is reconcilable to the information submitted in its year-end 
Reports on Budget Execution and Budgetary Resources (SF-133s). This information will be used 
as input for the fiscal year 20X2 actual-year column of the Program and Financing Schedules 
reported in the fiscal year 20X4 Budget of the U.S. Government. Such information is supported by 
the related financial records and data. 


We have disclosed in the financial statements all material dedicated collections as defined by 
Statement of Federal Financial Accounting Standard 43 and all other material restricted funds 
OR [There are no material dedicated collections or other material restricted funds that require 
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disclosure in the financial statements]. 


Service Organizations 


56. 


57. 


[“[Entity]” does not use service organizations.] OR Service organizations [and subservice 
organizations, if any] that we use have not reported to us, nor are we otherwise aware of, any (1) 
fraud; (2) noncompliance with applicable laws, regulations, contracts, or grant agreements; or 
(3) uncorrected misstatements affecting the financial statements that are attributable to such 
service [or subservice, if any] organizations. 


[If any such knowledge has been obtained, it should be described or specifically state how it was 
communicated to us. ] 


[If entity uses service organizations] Service organizations [and subservice organizations, if any] 
that we use have not reported to us, nor are we otherwise aware of, any changes in the design, 
implementation, or operating effectiveness of internal controls at the service organizations [or 
subservice organizations, if any] subsequent to the effective dates of the service and subservice 
organizations’ report(s) provided to you that could (1) affect the risks of material misstatement of 
the financial statements or (2) result in material misstatements of the financial statements arising 
from processing errors that would not be prevented, or detected and corrected, on a timely basis. 


[If any such knowledge has been obtained, the letter should describe it or refer to how it was 
communicated to us, including the effects, if any, on the financial statements and/or the effectiveness 
of internal control over financial reporting, including specific identification of any internal control 
deficiencies that are considered to be material weaknesses or significant deficiencies. ] 


[Signed by Entity Head] 


[Signed by Chief Financial Officer] 


Enclosure(s) 
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